Analysis
-
max time kernel
153s -
max time network
83s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 04:29
Behavioral task
behavioral1
Sample
61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe
-
Size
43KB
-
MD5
92800272c08213ac0e30a3e7ea34aebb
-
SHA1
63bdc8c65edb72edff6edcb529f7bb18dff62b6c
-
SHA256
61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1
-
SHA512
04f160166a81d08cdd236a56f484b4ff947636762a62a2167b2d1db07109d25c4909e9a207b37c1affc3e3a05e835ab68c2ede5ca69db9e99c345837aaaf0977
Malware Config
Extracted
Family
njrat
Version
Njrat 0.7 Golden By Hassan Amiri
Botnet
HacKed
C2
misha104.ddns.net:5552
Mutex
Windows Update
Attributes
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exepid process 1080 61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
Processes:
61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exedescription pid process Token: SeDebugPrivilege 1080 61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe Token: 33 1080 61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe Token: SeIncBasePriorityPrivilege 1080 61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe Token: 33 1080 61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe Token: SeIncBasePriorityPrivilege 1080 61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe Token: 33 1080 61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe Token: SeIncBasePriorityPrivilege 1080 61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe Token: 33 1080 61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe Token: SeIncBasePriorityPrivilege 1080 61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe Token: 33 1080 61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe Token: SeIncBasePriorityPrivilege 1080 61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe Token: 33 1080 61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe Token: SeIncBasePriorityPrivilege 1080 61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe"C:\Users\Admin\AppData\Local\Temp\61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken